CVE-2026-107302: msgpack5: Truncated map32 headers throw an unexpected error

October 8, 2026 (updated October 19, 2026)

A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.

References

github.com/advisories/GHSA-8f34-f56x-9xph
github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1
github.com/mcollina/msgpack5/releases/tag/v6.1.0
github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph
nvd.nist.gov/vuln/detail/CVE-2026-107302

Code Behaviors & Features

Detect and mitigate CVE-2026-107302 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →